3 ms·
Having the private key on a server for a certificate authority in 2018 is an unnecessary risk. They should have had a hardware security module where the private
by SEJeff 9y ago
Having the private key on a server for a certificate authority in 2018 is an unnecessary risk. They should have had a hardware security module where the private key can not be extracted out.
When you can buy one relatively cheaply even from yubico, there is simply no excuse to not using one as a CA.
https://www.yubico.com/products/yubihsm/ https://www.yubico.com/products/yubihsm/
All of their certs should be revoked and they should go out of business for technical incompetence plain and simple.
- verytrivial 9y agoForgive my ignorance, but how does a device capable of storing something like 127 keys help a CA whom should have been storing zero client keys? Do you mean for their own keys?
- SEJeff 9y agoTL;DNR: I'm an idiot and misread the story thinking the executive sent the ca private key, not the client keys This is even more egregious. Thanks for the cluebat hit to the face!